GDPR for HR: Managing Employee Data from Recruitment to Exit

GDPR for HR matters because HR teams handle some of the most sensitive information an organisation holds. Managing it properly requires more than secure storage: it means understanding why information is needed, who can access it, how it can be used and when it should be deleted.

Introduction

From the moment someone applies for a job until long after they leave an organisation, HR teams collect, use, share and retain considerable amounts of personal information.

Recruitment applications, interview notes, payroll details, performance assessments, sickness records, disciplinary investigations and references all involve personal data. Some information, particularly relating to health, is especially sensitive.

The UK GDPR establishes rules for how this information should be handled. However, applying those rules in practice can be challenging. What information can employers collect? Who should have access to it? Can managers share information about employees? And what happens to personnel records when someone leaves?

Understanding GDPR across the employee lifecycle helps HR teams protect employees, reduce organisational risks and manage information more confidently.

This article will follow the employee journey, highlighting key obligations, common mistakes and practical safeguards.

Understanding GDPR in the Employment Relationship

There are five core principles to understand

What counts as employee data
Complying with people’s data rights
Why consent is usually not an appropriate lawful basis for processing employee data
Handling special category and criminal offence data
Keeping data safe and secure

What Counts as Employee Data?

Under the GDPR personal data is anything that by itself or in combination with other data could lead to a person being identified. Examples include:

Contact and identification details.
Recruitment applications and interview assessments.
Employment contracts and payroll information.
Performance, disciplinary and grievance records.
Sickness absence and occupational health information.
Workplace monitoring records.
References and exit documentation.

It also includes things like meta data around documents, calls and recordings; CCTV footage; logs of access and use of systems; and things like job title, employee reference number or payroll number.

Complying with People’s Data Rights

Throughout your employment processes people have GDPR rights including:

The right to be informed, so you must inform people throughout the time your process their data of what you are processing and why
The right of access, so you must consider and respond to subject access requests.

We discuss people’s data rights in more detail below

Avoid Using Consent as a Lawful Basis

Consent is one lawful basis for processing personal data among several. Consent itself is no better or worse than any other and in a employer/employee relationship it can cause problems, so should be avoided.

This is because for consent to be valid it must be freely given. The imbalance of power between employers and employees can make it difficult to demonstrate that consent is freely given.

Also, consent can be withdrawn at any time which might be an issue for employers.

Employers should therefore identify an appropriate lawful basis for each processing purpose, rather than routinely asking employees to consent.

Special Category and Criminal Offence Data

Certain types of information such as data relating to health, trade union membership, gender or ethnicity has additional protections under the GDPR. Data of these types is call special category data. Often employers need to process special category date for a range of reasons, from equality monitoring to occupational health.

Special category data requires an additional, secondary lawful basis that is more specifically linked to a particular activity.

At each stage of the employee lifecycle you should be aware of what data you need and the lawful basis for processing it.

Keeping Data Safe and Secure

At all points through the employee’s data lifecycle from recruitment to retirement you must put in place appropriate technical and organisational measures to keep personal data secure. Examples include training managers and HR people to understand personal data processing and having systems with appropriate access control. Appropriate due diligence and oversight must also be applied to providers such as recruitment agencies and payroll providers.

Overarching Activities

At every stage of the lifecycle of applicant and employee data some common activities apply.

Firstly, you must record your data processing in your Record of Processing Activities or RoPA. This is a statutory requirement that places a duty on organisations to keep a record of the types of personal data they use and for what purposes.

Secondly you must provide appropriate privacy information. This is another statutory requirement under the GDPR’s Right to Be Informed. It means you must explain to people what data about them you are collecting and processing, why, and their rights in relation to this.

Thirdly as noted above you must apply appropriate security arrangements to the data. This is a combination of technical security – role based access, encryption in transit, etc – and organisational measures – policies, procedures and training.

GDPR for HR: employee data lifecycle

Recruitment and Selection

What information can employers legitimately collect about job applicants, and how should they use it? The first thing to consider is data minimisation and only collecting information necessary for the recruitment process.

Sources of data are primarily data subjects in the form of job applicants. They will provide information in application forms, CVs, and documents such as proof of qualifications. They may also provide additional information in the form of health screening or equality monitoring forms.

At the next stage further data will be collected via interview notes and assessment results.

People applying for roles will only give information asked for, so recruiters must be careful to limit their data requests to what is necessary, reasonable and fair.

Once an offer is made pre-employment checks are done. This includes checking references – which will involve processing the data of third parties – and performing statutory right to work checks. Some roles in some organisations may required criminal record checks.

Criminal record checks require an appropriate legal justification and compliance with the additional rules governing criminal offence data.

Like criminal records, data relating to health, ethnicity and religion also has particular. However, it may be necessary for some role to process data for, for example, reasonable adjustment requests and equality monitoring information. The key thing is to understand what data you need, and what purposes you need it for. There is no blanket legal basis for processing personal data for recruitment purposes and it is likely several lawful bases will be relied on to process all the data you need for recruitment.

Recruitment Agencies and Applicant Tracking Systems

If you use an external agency to support or manage recruitment, or third party platform to receive and manage applications, you will need to have an appropriate agreement in place that covers data collection and processing. This agreement will set out which party if the controller – usually the recruiting organisation – and the other is the processor, who processes personal data only on the controller’s instructions. Sometimes both parties are controllers, which means broadly that they both can decide what data are collected and what they are used for.

Retention of Application Data

Data relating to employment applications should only be retained for limited periods, and only the minimum necessary data retained. The data of unsuccessful applicants will usually gave a lower retention period although in some instances identifiable data may need to be kept for legal reasons. This should be by exception and each instance have clear justifiable reasons.

Successful applicant data will be retained for longer as an employer will have a longer-term relationship with these people but again only the minimum necessary data should be kept for specific employment related purposes.

Overall recruitment information should be relevant, fairly collected, appropriately used and retained only as long as necessary.

Onboarding and Starting Employment

How should employers establish appropriate information handling arrangements when someone joins?

Collecting Essential Employment Information

Employers collect bank details, emergency contacts, identification information, tax information and other data that is necessary for the ongoing relationship with employees.

Like recruitment these will rely on a range of lawful bases, with different processing activities having a different legal foundation under GDPR.

Payroll reporting for tax purposes is an example of a legal obligation, and processing genuinely necessary for the employment contract (such as actually paying employees) would be a contractual necessity.

Employees should be told about how their information will be used, shared, retained and protected through either the employer’s general privacy notice, or an employee specific one.

As noted above employers should assess payroll providers, HR software providers and occupational health services, including appropriate contractual and security arrangements, to help ensure they meet their accountabilities as data controllers for the purposes of the GDPR.

Managing Employee Information During Employment

How can HR teams use and share employee information appropriately during the employment relationship? There are a number of factors to consider

Personnel records and data accuracy

Employee information should be kept accurate and up to date. You can help ensure this by running regular exercises asking people to confirm whether the data you hold about them has changed, as well as asking them to let you know in real time if they, for example, move home or have a different emergency contact.

One of the challenges you may face is if people dislike or disagree with an opinion that is recorded about them. While you have a general duty to correct inaccurate or incomplete records opinions, which can be subject, can be more problematic. However, so long as the opinion (whether right or wrong) is recorded accurately then there are limited grounds to change it. You can, however, record the person’s disagreement or objection in your records.

Performance management

Managing performance is another example of ongoing personal data collection through the employee’s data lifecycle. Performance management will include appraisal records, performance improvement plans, manager notes and other assessments.

The challenge for HR when it comes to the operational collection of personal data for oversight and management purposes is ensuring fairness, accuracy, relevance and appropriate access. One issue that can arise is if one person is subject to disproportionate or excessive scrutiny. HR should ensure there are systems in place to limit data collected to what is necessary and flag up where additional data collection and processing may be necessary.

Disciplinary and grievance investigations

One area where strict procedural and evidentiary rules are often needed are complaints and investigations. This will often involved collecting evidence, interviewing witnesses, sharing information and retaining investigation records that directly identify individuals. This will include people other than the subject of a grievance or disciplinary so additional care must be taken to keep information confidential, accurate and reduce access to a minimum.

Sharing information between managers

Sometimes managers may need to discuss an employee’s performance, attendance or health-related adjustments. Such discussions should be strictly fact based and avoid any subjective comments, or anything people may object to. It is important managers understand such conversations are disclosable under a subject access request. Managers must also avoid using personal communication tools like whatsapp to share information as that in itself could constitute a data breach, as could sharing excessive information

For example: a manager wants to share an employee’s sickness history with the wider management team to explain operational difficulties.

The manager should consider what information recipients actually need. It may be appropriate to share relevant operational implications (we were short stasff due to sickness absence) without disclosing detailed medical information.

Payroll and benefits administration

Pay and benefits are an example of routine processing and information sharing with appropriate service providers. There should be appropriate data sharing agreements or contracts in place with appropriate security, and arrangements in place to keep data accurate and up to date – including removing personal data that is no longer needed.

Managing Health and Other Sensitive Employee Information

Although health data appear throughout the employee lifecycle, their sensitivity means they need special attention. Examples of health related information include:

Sickness absence records and fit notes.
Occupational health reports.
Disability and reasonable adjustments.
Health surveillance and workplace safety.

Other types of sensitive personal data include

Trade union membership information.
Equalities monitoring information.
Information relating to religion

Sensitive personal data like this needs a second lawful basis to be processed on top of the main lawful bases most data processing relies on. For example an occupational health report would rely:

Firstly on the contractual lawful basis (for the purposes of fulfilling a contract of employment) and
Secondly on the basis health data needs to be processed for employment purposes

Even then the usual restrictions apply: only the minimum necessary data should be processed and it should be accessible only to those who need it.

For example an occupational health provider produces a detailed report containing an employee’s medical history. The employee’s line manager should not receive the entire report, but instead only the information needed to understand fitness for work, restrictions and adjustments.

Employee Monitoring and Workplace Surveillance

Employers may wish to implement some form of employee monitoring for a range of reasons. Employee monitoring can be done in the form of CCTV, email monitoring, internet use, location tracking, productivity monitoring and AI-enabled workforce analytics.

As with all forms of employee data processing monitoring must have an appropriate lawful basis and satisfy fairness, necessity, proportionality and transparency requirements. Employers may have legitimate reasons to monitor workplace activities, but that does not justify unrestricted surveillance.

You can learn more about employee monitoring here.

Employee Data Rights and Subject Access Requests

Explain that employees, job applicants and former employees have rights under the UK GDPR. The main one people exercise, and one of the most challenging is subject access requests.

Subject access requests

A subject access request entitles people to a copy of their personal data and supplementary information about the purpose and lawful basis for processing, among other things. One of the main practical difficulties employers and HR teams have is locating and reviewing:

Emails and Teams messages.
Performance assessments.
Disciplinary and grievance records.
Manager notes.
References.
Information about other employees.

A particular challenge is redacting the data of other people, as people are generally not allowed this as part of a request for their own data.

Employees can make a subject access request even if they are involved in a dispute or an employment tribunal, but there are exemptions to disclosing information and searches for data must be “reasonable and proportionate” rather than exhaustive. It is important to understand any request’s scope, reviewing information and applying relevant exemptions correctly.

Information is not automatically exempt simply because it is embarrassing, confidential or relevant to a dispute. Requests cannot be refused on the basis of why someone wants it, or whether providing information would present a burden

For example: a former employee submits a subject access request following a disciplinary dispute and asks for all emails in which they are mentioned.

The employer needs a structured response process to find and review the requested data, and redact third party data such as sender or recipient emails and names rather than assuming it must disclose every email in full or can refuse the request because litigation is anticipated.

Find out more about handling subject access requests here

Other individual rights

Like anyone else employees also have a range of other GDPR rights including:

The right to be informed, which you deliver through the privacy information discussed above
The right to rectification, which helps people keep their data secure
Other rights relating to erasure, and restricting processing

None of these rights are absolute and how they work in part depends on the lawful basis for processing (the right to object, another right, is easier to apply when consent is the lawful basis than processing based on a legal obligation).

You can find out more on all of these rights here.

GDPR Training Designed for HR Professionals

Our GDPR for HR Professionals training course provides practical guidance on applying the UK GDPR to real workplace situations.

You’ll explore how to handle employee information lawfully, manage sensitive records, respond to employee data rights and avoid common compliance mistakes.

Whether you’re an HR manager, people professional or responsible for employee information, the course will help you make more confident, informed decisions.

Explore Our GDPR for HR Training Course

Five star training course feedback and rating

Employee Departure and Offboarding

What should happen to employee information when the employment relationship ends? Data relating to employee departure can come from notice or dismissal letters, exit interviews, final payroll information, references, disciplinary records and other relevant documentation. There are a number of things to consider when handling the data of ex-employees

Access removal

Employees have system access, shared accounts, remote access and physical access permissions. These should be reviewed and removed promptly at the end of the employment relationship.

Retention periods

Not all employee information must be deleted immediately upon departure. Some records must be retained to meet statutory obligations or for other legitimate purposes. Examples include limited employment information for references, financial information for tax and other purposes, and in the longer term pension related information. Different categories of information may require different retention periods.

Where data is no longer needed it must be destroyed securely. You can retain fully anonymised data for analytics or reporting purposes indefinitely but fully anonymised means just that – do not link data to employee reference numbers, payroll numbers or other references as they are identifiers too.

Common GDPR Mistakes Made by HR Teams

Some common mistakes readers may recognise include:

Relying on employee consent when another lawful basis is more appropriate. This is partly because consent must be freely given, which is difficult to demonstrate given the relative imbalance of power between employers and employees, and because consent can be withdrawn at any time.
Allowing managers unrestricted access to personnel files. People should only have access to (and share) the information that is necessary for them to perform their roles.
Sharing excessive health information. Because of the special protections for health information extra care should be taken on the collection and processing of, and access to employee health information.
Keeping inaccurate or outdated records. As well as being a breach of core GDPR duties this can cause issues if outdated information prevents you from performing core functions.
Failing to inform employees about monitoring. Employees must be informed of all the uses of their data, including monitoring, and their rights to control this.
Assuming disciplinary records are automatically exempt from subject access requests. This is not true. However, care must be taken to avoid disclosing the data of other people and anything that may be legally privileged.
Retaining employee information indefinitely. Strict retention periods must be applied to all employee data, and data that is no longer necessary must be destroyed. Do not assume that if someone is still an employee then all their data should be retrained.
Failing to review supplier and HR software arrangements. Requirements change and it is important to review vendor agreements to ensure they are still appropriate for your data processing and information security arrangements.
Treating GDPR compliance as solely the responsibility of the DPO or legal team. The DPO or legal team can provide advice, but HR as the subject matter experts should take the lead in decision making on appropriate data protection arrangements for employee data.

Employee Data Checklist

You can use the checklist below to help check your own employee data practices and see where they may be scope for improvement

GDPR for HR: Checklist

Building Good Data Protection Practices in HR

To achieve sustainable GDPR systems shift the focus from individual compliance activities to building sustainable practices. We suggest five priorities, although what you do will depend in part on your own organisation’s current processes and context:

Clear responsibilities: Define what HR, managers, IT and the DPO are responsible for. For example, your DPO may be responsible for advising on exemptions, communicating with people making subject access requests while IT will have a key role in helping the search for information and sharing large data files.
Appropriate policies: Maintain practical procedures and processes for recruitment, employee records, monitoring, SARs and retention. It is important that polices set out organisational expectations, the responsibility of all staff to comply with GDPR and report any issues, and where people can go for help.
Staff training: Ensure HR professionals and managers understand their responsibilities. General, all-staff training is not enough for specialist roles and role based training must be considered for HR professionals.
Regular reviews: Check that policies and practices reflect how the organisation actually operates. As systems and structures change there is a risk of gaps and blind spots appearing in your compliance activities.
Continuous improvement: Use incidents, complaints and audits to identify weaknesses. A key element of demonstrating accountability for GDPR compliance is learning and improving.

Conclusion

From recruitment through to departure, HR teams handle personal information that employees trust their organisation to manage appropriately.

Effective GDPR compliance requires more than policies and secure systems. It depends on collecting the right information, using it fairly, restricting access, responding properly to individual rights and retaining records only for as long as necessary.

By understanding how data protection responsibilities apply throughout the employee lifecycle, HR professionals can reduce risks, improve working practices and help build trust.

GDPR Training Designed for HR Professionals

From recruitment and employee monitoring to disciplinary investigations, subject access requests and retention, HR teams face data protection challenges throughout the employment relationship.